Restic - Revision history

Phobos: added section for connecting to a REST server with secrets

2026-03-24T23:52:32Z

added section for connecting to a REST server with secrets

@@ Line 26: / Line 26: @@
 <syntaxhighlight lang="console">
-$ nix shell nixpkgs#apacheHttpd -c htpasswd -B -c .htpasswd user
+$ nix shell nixpkgs#apacheHttpd -c htpasswd -B -c .htpasswd YOUR_USER
-</syntaxhighlight>
+</syntaxhighlight>To declaratively use the <code>htpasswd</code> file you will need to use a [[Comparison of secret managing schemes|secret management method]]. The following example uses [https://github.com/Mic92/sops-nix sops-nix].
 {{File|3={config,inputs,...}:
@@ Line 58: / Line 54: @@
 }|name=configuration.nix|lang=nix}}
 == Security Wrapper ==

Phobos: fixed user

2026-03-24T22:29:05Z

fixed user

← Older revision		Revision as of 22:29, 24 March 2026
Line 26:		Line 26:

	<syntaxhighlight lang="console">		<syntaxhighlight lang="console">
	$ nix shell nixpkgs#apacheHttpd -c htpasswd -B -c .htpasswd ~~YOUR_USERNAME~~		$ nix shell nixpkgs#apacheHttpd -c htpasswd -B -c .htpasswd user
	</syntaxhighlight>		</syntaxhighlight>

Phobos: formatted code, added example sops

2026-03-24T21:19:09Z

formatted code, added example sops

@@ Line 21: / Line 21: @@
 Restic Rest Server is one of the options for a remote repository<ref>https://restic.readthedocs.io/en/latest/030_preparing_a_new_repo.html#rest-server</ref>. It can be installed by enabling the <code>services.restic.server.enable</code> option. By default the server requires either providing it with <code>htpasswd</code> file or running it without authentication. If provided, the username and password pairs <code>htpassd</code> file will be used to authenticate the restic clients connecting to the server. To run the server without authentication, you can pass the flag using the <code>extraFlags</code> option like this: <code>services.restic.server.extraFlags = [ "--no-auth" ];</code>
-Passing the <code>htpasswd</code> file should be done using one of the [[Comparison of secret managing schemes|secret management methods]].
+==== Using a htpasswd file ====
 A htpasswd file must be created using the <code>apacheHttpd</code> package. Assuming that you do not already have this package, you may run the following to generate the file using nix shell. Note that the file will be hidden due to the "." at the start of the file.
@@ Line 29: / Line 27: @@
 <syntaxhighlight lang="console">
 $ nix shell nixpkgs#apacheHttpd -c htpasswd -B -c .htpasswd YOUR_USERNAME
 == Security Wrapper ==
-If you want to back up your system [https://restic.readthedocs.io/en/latest/080_examples.html#backing-up-your-system-without-running-restic-as-root without running restic as root], you can create a user and security wrapper to give restic the capability to read anything on the filesystem as if it were running as root. The following will create the wrapper at <code>/run/wrappers/bin/restic</code>
+If you want to back up your system [https://restic.readthedocs.io/en/latest/080_examples.html#backing-up-your-system-without-running-restic-as-root without running restic as root], you can create a user and security wrapper to give restic the capability to read anything on the filesystem as if it were running as root. The following will create the wrapper at <code>/run/wrappers/bin/restic</code>:
-<syntaxhighlight lang="nix">
+  security.wrappers.restic = {
-users = {
+    source = lib.getExe pkgs.restic;
-  users.restic = {
+    owner = "restic";
      group = "restic";
-     isSystemUser = true;
+     permissions = "500"; # or u=rx,g=,o=
    };
-  groups.restic = {};
+}|name=configuration.nix|lang=nix}}
 [[Category:Applications]]
 [[Category:Backup]]

Phobos: Added note for creating htpasswd file

2026-03-24T20:24:33Z

Added note for creating htpasswd file

← Older revision		Revision as of 20:24, 24 March 2026
Line 22:		Line 22:

	Passing the <code>htpasswd</code> file should be done using one of the [[Comparison of secret managing schemes\|secret management methods]].		Passing the <code>htpasswd</code> file should be done using one of the [[Comparison of secret managing schemes\|secret management methods]].

			==== Creating a htpasswd file ====

			A htpasswd file must be created using the <code>apacheHttpd</code> package. Assuming that you do not already have this package, you may run the following to generate the file using nix shell. Note that the file will be hidden due to the "." at the start of the file.

			<syntaxhighlight lang="console">
			$ nix shell nixpkgs#apacheHttpd -c htpasswd -B -c .htpasswd YOUR_USERNAME

			</syntaxhighlight>



	== Security Wrapper ==		== Security Wrapper ==

Wo2wz: improve wrapper example config

2025-11-02T18:37:19Z

improve wrapper example config

← Older revision		Revision as of 18:37, 2 November 2025
Line 27:		Line 27:
	If you want to back up your system [https://restic.readthedocs.io/en/latest/080_examples.html#backing-up-your-system-without-running-restic-as-root without running restic as root], you can create a user and security wrapper to give restic the capability to read anything on the filesystem as if it were running as root. The following will create the wrapper at <code>/run/wrappers/bin/restic</code>		If you want to back up your system [https://restic.readthedocs.io/en/latest/080_examples.html#backing-up-your-system-without-running-restic-as-root without running restic as root], you can create a user and security wrapper to give restic the capability to read anything on the filesystem as if it were running as root. The following will create the wrapper at <code>/run/wrappers/bin/restic</code>

	<~~syntaxHighlight~~ lang=nix>		<syntaxhighlight lang="nix">
	users.users.restic = {		users = {
	~~isNormalUser~~ = ~~true~~;		users.restic = {
			group = "restic";
			isSystemUser = true;
			};
			groups.restic = {};
	};		};

	security.wrappers.restic = {		security.wrappers.restic = {
	source = ~~"${~~pkgs.restic~~.out}/bin/restic"~~;		source = lib.getExe pkgs.restic;
	owner = "restic";		owner = "restic";
	group = "~~users~~";		group = "restic";
	permissions = "u=~~rwx~~,g=,o=";		permissions = "500"; # or u=rx,g=,o=
	capabilities = "cap_dac_read_search=+ep";		capabilities = "cap_dac_read_search+ep";
	};		};
	</~~syntaxHighlight~~>		</syntaxhighlight>

	Note that you will have to set your Restic configuration to use the wrapper using the [https://search.nixos.org/options?channel=unstable&show=services.restic.backups.%3Cname%3E.package&from=0&size=50&sort=relevance&type=packages&query=services.restic.backups services.restic.backups.<name>.package] option, for example <ref>https://github.com/NixOS/nixpkgs/issues/341999#issuecomment-2558504576</ref>,		Note that you will have to set your Restic configuration to use the wrapper using the [https://search.nixos.org/options?channel=unstable&show=services.restic.backups.%3Cname%3E.package&from=0&size=50&sort=relevance&type=packages&query=services.restic.backups services.restic.backups.<name>.package] option, for example <ref>https://github.com/NixOS/nixpkgs/issues/341999#issuecomment-2558504576</ref>,

LucasFA: /* Restic */ Add a reference to the backups..createWrapper option

2025-08-24T22:22:03Z

Restic: Add a reference to the backups.<name>.createWrapper option

← Older revision		Revision as of 22:22, 24 August 2025
Line 16:		Line 16:
	NixOS provides options to create a systemd timer and a service that will create the backups. See [https://search.nixos.org/options?channel=unstable&from=0&size=50&sort=relevance&type=packages&query=services.restic.backups services.restic.backups options] and "[https://restic.readthedocs.io/en/stable/040_backup.html Backing up]" in the restic documentation.		NixOS provides options to create a systemd timer and a service that will create the backups. See [https://search.nixos.org/options?channel=unstable&from=0&size=50&sort=relevance&type=packages&query=services.restic.backups services.restic.backups options] and "[https://restic.readthedocs.io/en/stable/040_backup.html Backing up]" in the restic documentation.

	Note that NixOS includes an option to automatically create the repository by specifying <code>services.restic.backups.<name>.initialize = true</code>;		Note that NixOS includes an option to automatically create the repository by specifying <code>services.restic.backups.<name>.initialize = true;</code>, as well as a wrapper to run restic in the same environment as the systemd jobs in <code>services.restic.backups.<name>.createWrapper</code>

	=== Restic Rest Server ===		=== Restic Rest Server ===

Atomicraccoon: Add clarification to further modifications needed for wrapper

2025-07-14T08:10:46Z

Add clarification to further modifications needed for wrapper

@@ Line 40: / Line 40: @@
 };
 </syntaxHighlight>
 [[Category:Applications]]
 [[Category:Backup]]

VTimofeenko: /* Restic */ add upstream doc link for configuring the backup and mention initialize option

2025-02-12T03:29:04Z

Restic: add upstream doc link for configuring the backup and mention initialize option

← Older revision		Revision as of 03:29, 12 February 2025
Line 1:		Line 1:
	[https://restic.net/ Restic] is a fast and secure backup program. NixOS packages both <code>restic</code> client (program used to make backups) and <code>restic-rest-server</code> (one of the backends to store the backups remotely, "~~repository~~" in restic parlance).		[https://restic.net/ Restic] is a fast and secure backup program. NixOS packages both <code>restic</code> client (program used to make backups) and <code>restic-rest-server</code> (one of the backends to store the backups remotely, "repositories" in restic parlance).

	== Installing ==		== Installing ==
Line 14:		Line 14:

	=== Restic ===		=== Restic ===
	NixOS provides options to create a systemd timer and a service that will create the backups. See [https://search.nixos.org/options?channel=unstable&from=0&size=50&sort=relevance&type=packages&query=services.restic.backups services.restic.backups options].		NixOS provides options to create a systemd timer and a service that will create the backups. See [https://search.nixos.org/options?channel=unstable&from=0&size=50&sort=relevance&type=packages&query=services.restic.backups services.restic.backups options] and "[https://restic.readthedocs.io/en/stable/040_backup.html Backing up]" in the restic documentation.

			Note that NixOS includes an option to automatically create the repository by specifying <code>services.restic.backups.<name>.initialize = true</code>;

	=== Restic Rest Server ===		=== Restic Rest Server ===

VTimofeenko: Expand intro and add configuration options

2025-02-12T01:09:59Z

Expand intro and add configuration options

← Older revision		Revision as of 01:09, 12 February 2025
Line 1:		Line 1:
	[https://restic.net/ Restic] is a fast and secure backup program.		[https://restic.net/ Restic] is a fast and secure backup program. NixOS packages both <code>restic</code> client (program used to make backups) and <code>restic-rest-server</code> (one of the backends to store the backups remotely, "repository" in restic parlance).

	== Installing ==		== Installing ==

	~~Add~~ <code>restic</code> to <code>environment.systemPackages</code> like so:		If you want to manually create restic backups, add <code>restic</code> to <code>environment.systemPackages</code> like so:

	<syntaxHighlight lang=nix>		<syntaxHighlight lang=nix>
Line 10:		Line 10:
	];		];
	</syntaxHighlight>		</syntaxHighlight>

			== Configuring ==

			=== Restic ===
			NixOS provides options to create a systemd timer and a service that will create the backups. See [https://search.nixos.org/options?channel=unstable&from=0&size=50&sort=relevance&type=packages&query=services.restic.backups services.restic.backups options].

			=== Restic Rest Server ===
			Restic Rest Server is one of the options for a remote repository<ref>https://restic.readthedocs.io/en/latest/030_preparing_a_new_repo.html#rest-server</ref>. It can be installed by enabling the <code>services.restic.server.enable</code> option. By default the server requires either providing it with <code>htpasswd</code> file or running it without authentication. If provided, the username and password pairs <code>htpassd</code> file will be used to authenticate the restic clients connecting to the server. To run the server without authentication, you can pass the flag using the <code>extraFlags</code> option like this: <code>services.restic.server.extraFlags = [ "--no-auth" ];</code>

			Passing the <code>htpasswd</code> file should be done using one of the [[Comparison of secret managing schemes\|secret management methods]].

	== Security Wrapper ==		== Security Wrapper ==

Klinger: Category:Applications Category:Backup. Link to restic.

2024-06-20T16:41:32Z

Category:Applications Category:Backup. Link to restic.

← Older revision		Revision as of 16:41, 20 June 2024
Line 1:		Line 1:
	Restic is a fast and secure backup program.		[https://restic.net/ Restic] is a fast and secure backup program.

	== Installing ==		== Installing ==
Line 28:		Line 28:
	};		};
	</syntaxHighlight>		</syntaxHighlight>

			[[Category:Applications]]
			[[Category:Backup]]